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(57) ABSTRACT 

Security services and policy enforcement for electronic data 
is provided through a series of transactions among a server 
and clients using electronic security certificates. A first client 
generates a digest from the electronic data, and submits a 
security certificate request containing the digest to a trusted 
arbitrator server, where the request is time stamped and 
logged. The trusted arbitrator authenticates the first client's 
credentials and returns the security certificate to the first 
client. The data and security certificate are combined to 
create a distribution unit. A second client acquires the 
distribution unit, extracts the security certificate, and gen- 
erates a digest from the data. If the digest from the second 
client matches the logged digest from the first client, the data 
is valid. Depending on the certificate type and policy level, 
the trusted arbitrator server provides other services to the 
clients, such as notification of improper user of the data. 

29 Claims, 23 Drawing Sheets 
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Detailed Description Text - DETX (48): 

The system level overview of the operation of exemplary embodiments of the 
invention has been described in this section of the detailed description. A 
series of transactions among parties that provide security services and policy 
enforcement for the distribution and use of electronic data has been described. 
For sake of clarity a simplified version of protecting software applications 
distributed across the Internet has been described. The invention is not, 
however, limited to use in distributing computer software across a network but 
will be immediately perceived as applicable to any exchange of files or 
documents which must be authenticated or validated in some fashion, such as 
legal papers, tax filings, employment records, or the like. Furthermore, 
although the distribution unit used for illustrative purposes in this section 
contains a single distribution unit, the ability to have multiple distribution 
units in a distribution unit, or to nest distribution units is also 
contemplated by the invention. 
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